<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi,</p>
<p>actually, if all the additional DNS servers are on the same
device (where also DNSmasq runs on), you can simply assign one or
more ULAs (I use fd53::1) to the device's interface and announce
it to all devices as DNS. The clients will see that the device is
in another network and send it out for routing to your router. The
Router device will forward it to the other local interface
automatically.</p>
<p>So basically easiest ist to assign addition ULA address to one of
the router's interfaces and let listen alternative DNS on it. You
don't need to announce ULA outside.</p>
<p>This type of configuration is used by most consumer routers
(e.g., by AVM's FritzBOX) for the same reason like described by
you. Here is my own "iflan" ethernet interface on my
Ubuntu-Router:</p>
<blockquote>
<p><font face="monospace">iflan:
flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500<br>
inet 192.168.1.1 netmask 255.255.255.0 broadcast
192.168.1.255<br>
inet6 2a00:c380:xxxxxxxxxxxxxx::1 prefixlen 64
scopeid 0x0<global><br>
inet6 fe80::1 prefixlen 64 scopeid 0x20<link><br>
<b>inet6 fd53::1 prefixlen 128 scopeid
0x0<global></b><br>
ether 76:35:3b:ae:7b:ba txqueuelen 1000 (Ethernet)<br>
RX packets 54020105 bytes 15416441867 (15.4 GB)<br>
RX errors 0 dropped 534516 overruns 0 frame 0<br>
TX packets 92451209 bytes 137807353683 (137.8 GB)<br>
TX errors 0 dropped 0 overruns 0 carrier 0
collisions 0</font></p>
</blockquote>
<p>Clients don't use ULA at all. Its just there. In dnsmasq it is
sent out like this:</p>
<p>dhcp-option=option6:ntp-server,fd53::1<br>
dhcp-option=option6:sntp-server,fd53::1<br>
dhcp-option=option6:dns-server,fd53::1</p>
<p>Clients don't deal with the address prefix at all, they only have
a global address and contact the router for routing:</p>
<blockquote>
<p><font face="monospace">Ethernet-Adapter ThinkDock Ethernet:<br>
<br>
Verbindungsspezifisches DNS-Suffix: home<br>
IPv6-Adresse. . . . . . . . . . . : 2a00:c380:</font><font
face="monospace">xxxxxxxxxxxxxx</font><font face="monospace">:5c7c<br>
Temporäre IPv6-Adresse. . . . . . : 2a00:c380:</font><font
face="monospace">xxxxxxxxxxxxxx</font><font face="monospace">:73cd<br>
Verbindungslokale IPv6-Adresse . :
fe80::4a2a:e3ff:fe43:5c7c%21<br>
IPv4-Adresse . . . . . . . . . . : 192.168.1.103<br>
Subnetzmaske . . . . . . . . . . : 255.255.255.0<br>
Standardgateway . . . . . . . . . : fe80::1%21<br>
192.168.1.1<br>
</font></p>
<p><font face="monospace">> tracert fd53::1<br>
<br>
Routenverfolgung zu sirius.home [fd53::1]<br>
über maximal 30 Hops:<br>
<br>
1 1 ms 1 ms 1 ms sirius.home [fd53::1]<br>
<br>
Ablaufverfolgung beendet.</font><br>
</p>
</blockquote>
<p>Uwe<br>
</p>
<div class="moz-cite-prefix">Am 03.07.2024 um 09:56 schrieb Nomad
Chen:<br>
</div>
<blockquote type="cite"
cite="mid:CAGsyRrM=oqP14HRAxLnE8driS5NNg10LGLgK-DD=6_z3ixP0yQ@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">Dear Dnsmasq Committe,<br>
<br>
I hope this message finds you well. I am a Dnsmasq user and I
have a question concerning the IPv6 Recursive DNS Server (RDNSS)
configuration that I'm hoping you can help with.<br>
I've built a router using Debian 12, employing Dnsmasq for DHCP
and DNS services.
<div>In my network, there are two separate DNS servers, also
built on Debian 12, each configured with static IPv4
addresses. <br>
</div>
<div>Due to my ISP providing a dynamic IPv6 prefix, network
devices obtain IPv6 addresses via SLAAC in Dnsmasq, which
prevents setting a fixed IPv6 Global Unicast Address (GUA) on
the internal DNS servers. To keep the network configuration
simple, I have not used IPv6 Unique Local Addresses (ULA).<br>
</div>
<div>For certain network devices, I need to specify gateways and
DNS servers, which I have accomplished for IPv4 using
Dnsmasq's static address binding and DNSv4 options. However, I
am encountering issues with the IPv6 configuration. </div>
<div>According to the man page:<br>
</div>
<div><br>
> --enable-ra<br>
> By default, the relevant link-local address of the
machine running dnsmasq is sent as a recursive DNS server. If
provided, the DHCPv6 options dns-server and domain-search are
used for the DNS server (RDNSS) and the domain search list
(DNSSL).<br>
<br>
I have tried various methods to remove DNS information from
the RA announcements to prevent network devices from receiving
an IPv6 DNS server address, thus avoiding conflicts with the
specified IPv4 DNS servers. </div>
<div>While I understand that clients can use both IPv4 and IPv6
DNS servers simultaneously, I have DNS configurations tailored
for different scenarios. <br>
</div>
<div>The reason for specifying different DNS servers for
different network devices is to ensure DNS service isolation
and prevent clients from receiving incorrect DNS query
results.<br>
</div>
<div>Unfortunately, I have not yet found a way to independently
disable IPv6 RDNSS when the 'enable-ra' option is configured
in Dnsmasq. This issue causes my network devices to always
receive the Dnsmasq-advertised Link-Local Address (LLA) as
their DNS server.<br>
Here is my current IPv6-related Dnsmasq configuration:<br>
<br>
interface=bridge1<br>
ra-param=bridge1,900,2700<br>
enable-ra<br>
dhcp-range=::,constructor:bridge1,slaac,45m<br>
<br>
I have tried changing the 'slaac' parameter in 'dhcp-range' to
'ra-only', but this still does not prevent network devices
from acquiring an IPv6 DNS.<br>
I would greatly appreciate any advice or solutions you might
have regarding this matter.<br>
<br>
Best regards,<br>
</div>
<div>Nomad</div>
</div>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
Dnsmasq-discuss mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk">Dnsmasq-discuss@lists.thekelleys.org.uk</a>
<a class="moz-txt-link-freetext" href="https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss">https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss</a>
</pre>
</blockquote>
<pre class="moz-signature" cols="72">--
Uwe Schindler
Achterdiek 19, D-28357 Bremen
<a class="moz-txt-link-freetext" href="https://www.thetaphi.de">https://www.thetaphi.de</a>
eMail: <a class="moz-txt-link-abbreviated" href="mailto:uwe@thetaphi.de">uwe@thetaphi.de</a></pre>
</body>
</html>